Start With Compliance
Meet Mastercard MMP Standards
Mastercard requires acquirers to run pre-transaction merchant scans, monitor password-protected areas of merchant websites, and prove continuous oversight across the entire merchant lifecycle.
As a registered Mastercard Merchant Monitoring Program (MMP) provider, LegitScript delivers all three, ensuring every risk flag is documented, every decision is defensible, and every audit is ready when you need it.
The New Standard
Three Requirements, Fully Covered
Mastercard’s latest MMP revision requires compliance oversight across the full lifecycle of a merchant relationship, and LegitScript delivers it, with pre-transaction website scans, persistent monitoring of restricted merchant content, and a documented audit trail ready for card network review.
1
Initial Scan
Every merchant is scanned before their first transaction runs, so risk is caught before it reaches your portfolio.
2
Persistent, Full-Site Monitoring
Ongoing monitoring reaches restricted and members-only areas, not just the public-facing site, so nothing stays out of view.
3
Documented, Auditable Evidence
Every scan and every monitoring action is logged into a record so that you can produce audit-ready MMSP reports.
Be MMP Ready
Everything the Standard Requires. Already Part of What You Use.
LegitScript is one of few companies authorized to deliver Mastercard-recognized merchant monitoring at scale, and the coverage below is already built into Merchant Risk Solutions.
Mandatory Initial Scans
Content Scan returns actionable risk intelligence in minutes, so no merchant transacts before you've seen what's actually on their site.
Persistent Monitoring of Gated & Members-Only Content
Merchant Monitoring combines automation with human expertise to uncover risk in password-protected environments.
Audit-Ready Documentation Built Into Our Solutions
Every merchant gets a documented audit trail, dated from day one of monitoring. Every risk flag is documented, every decision is defensible, and every audit is ready when you need it.
Support Across the Payments Ecosystem
Coverage for Everyone in the Chain
Mastercard’s Merchant Monitoring Program (MMP) updated rules raise expectations for both onboarding and ongoing oversight, requiring acquirers to demonstrate deeper visibility into merchant activity.
Acquirers
LegitScript gives you the initial scan and ongoing evidence Mastercard expects for every merchant in your portfolio, without slowing down approvals.
PSPs & PayFacs
Automated scans return results in minutes, so compliance keeps pace with onboarding volume and growth.
ISOs & Processors
Portfolio-wide visibility keeps every merchant’s scan and monitoring history documented and ready to produce at audit time.
Why LegitScript
Nearly 20 Years of Doing Exactly This
For nearly 20 years, payments leaders have trusted LegitScript to meet card network rules, adapt to new standards, and protect their portfolios at scale. We support some of the world’s largest payment facilitators, ISOs, and acquirers, and are one of the few companies authorized to deliver persistent merchant monitoring and transaction laundering detection at scale.
Credentials for password-protected merchant sites are handled under strict security protocols built specifically for this work, so compliance and data protection aren’t a trade-off.
Get Ahead of Mastercard’s Standard
Now is the time to prepare. Get a free look at what a pre-transaction scan surfaces on your own portfolio, or talk to us about persistent monitoring scoped to your merchant mix.
Frequently Asked Questions
Navigating Changes to Mastercard’s Merchant Monitoring Program
What has changed with Mastercard’s Merchant Monitoring Program?
Since Jan. 1, 2026, newly onboarded merchants have been required to undergo a website scan before their first transaction. Persistent monitoring after that point must also cover restricted, members-only areas of merchant websites.
What does this mean for the payments industry?
It's part of a larger shift: stricter oversight, more proactive monitoring, and zero tolerance for surface-level checks. Compliance is no longer a single checkpoint — it has to run across the full lifecycle of a merchant relationship.
Will this slow down onboarding?
Not with LegitScript. Our AI-powered scans in LegitScript Merchant Underwriting and LegitScript Content Scan return results in minutes, so you stay compliant without delaying merchant approvals.
What about approval rates?
They may shift slightly, but the bigger impact is improved visibility. Surfacing risk earlier means smarter decisions and fewer costly fraud or compliance issues down the line.
Can LegitScript provide the pre-transaction scan Mastercard now requires?
Yes. The Content Scan standalone module or Content Scan feature in Merchant Underwriting scans merchant websites and returns actionable risk intelligence in minutes.
Can LegitScript monitor members-only and restricted areas?
Yes. Merchant Monitoring combines automation with human expertise to uncover risk even in password-protected environments, where many automation-only competitors typically stop looking.
How does LegitScript manage credentials for password-protected websites?
We manage password-protected websites through dedicated systems and protocols for securely handling client-provided IDs and passwords, built to protect both compliance and data.
How scalable is this under the new requirements?
We’re built for scalability. LegitScript supports some of the world's largest payment facilitators, ISOs, and acquirers today, across large onboarding volumes and persistent monitoring at scale.
Why LegitScript?
Because we've done this repeatedly. For nearly 20 years, payments leaders have trusted LegitScript to meet card network rules, adapt to new standards, and protect their portfolios at scale.